Threat Brief: March 2026 Escalation of Cyber Risk Related to Iran (Updated March 26)

Unit 42 (March 2026) published multiple interrelated threat reports describing an uptick in Iranian-aligned destructive and espionage activity, expanding use of AI in malware, and growing abuse of social engineering and legitimate management tooling. Notable observations include increased wiper deployments by Handala Hack (aka Void Manticore) leveraging phishing and Microsoft Intune misuse; Boggy Serpens’ evolution to AI-enhanced malware and refined social engineering; identity weaponization and broader Iranian cyber operations; targeted espionage campaigns in Southeast Asia using USBFect, RAT